Post-Migration Checklist (per bootc host)

Run this after migrating each old VM to a bootc host (game, tail, plex, arr, web). It's the "is it actually done and durable" pass, not just "is it running."

Services & workloads

• systemctl --failed is clean
• Every quadlet running (systemctl status <svc>; podman ps shows all expected containers)
• On-demand services (e.g. ARK) start cleanly with systemctl start <svc>

Data & ownership

• Each app loads its real migrated data (worlds/saves/config), not a fresh instance
• /var/lib/<app> trees owned 1001:1001
• Source data on NFS retained until every app is verified

Secrets & config

• Machine-local env files rendered from vault (/etc/<app>/*.env), mode 0600
• No secrets committed to the repo
• App-specific auth handled (Steam re-seed, allowlists, server passwords, license keys)

Networking

• OPNsense port-forwards correct per service; no port collisions
• Admin/RCON ports NOT exposed to WAN
• DHCP reservation pinned for the host IP (NAT + SWAG depend on it)
• Cloudflare: raw-traffic names grey-clouded (DNS-only); HTTP apps via SWAG
• SWAG upstreams point at hostname/current IP; HTTP apps reachable over HTTPS incl. websockets

Updates & GitOps

• All config pushed to the repo (quadlets, ansible, images.json) so a fresh provision reproduces it
• No pet overrides left on the box (e.g. stray /etc/containers/systemd/* test files)
• systemctl list-timers shows podman-auto-update.timer and bootc-fetch-apply-updates.timer active
• Final bootc upgrade --apply done; box on latest image

Verification

• Full reboot test: box self-assembles unattended (disk mount, autostart services, secrets, data), no manual steps
• Each service reachable/functional from outside the LAN
• Logs clean: no crash-loops, no failed healthchecks

Backups & decommission

• /var/lib data backed up (nightly rsync to depot, or Proxmox VM backup)
• Old VM decommissioned once fully verified